The cookieless future was called off. Google confirmed in April 2025 that it would not deprecate third-party cookies in Chrome, and through 2025 it wound down most of Privacy Sandbox — Topics, Protected Audience and Attribution Reporting are all marked “intent to deprecate and remove” on Google’s own status page. Third-party cookies stay. Consent law, not the browser, is now the binding constraint.
What actually happened
For roughly five years, the industry planned around a date: Chrome would drop third-party cookies and Privacy Sandbox APIs would replace them. Neither happened.
- April 2025 — Google confirmed it would not deprecate third-party cookies in Chrome and would not ship the user choice prompt it had previously proposed. Third-party cookies continue to work as they always have.
- Through 2025 — Google wound down the bulk of Privacy Sandbox. Its status page now lists Topics, Protected Audience, Attribution Reporting, Related Website Sets, Private Aggregation, Shared Storage and IP Protection as intent to deprecate and remove, along with the Android equivalents.
- What survived — a much smaller, more boring set that was never really about replacing ad targeting: CHIPS (partitioned cookies, Chrome 114+), the Storage Access API (Chrome 119+), FedCM (federated sign-in, Chrome 108+) and Private State Tokens.
Why this matters more than it sounds
A great deal of privacy planning was quietly built on the assumption that the problem had an expiry date — that third-party cookies would disappear and take the compliance question with them. That was always a category error, and now it is plainly one.
Browser deprecation was never what made pre-consent tracking unlawful. The GDPR and ePrivacy don’t care whether an identifier is a third-party cookie, a first-party cookie, localStorage, or a server-set ID: storing or reading information on a user’s device without consent is the violation. Consent Mode, CMPs and cookie audits were never a bridge to the cookieless era. They were the actual requirement all along.
What genuinely changed for practitioners
- Stop deferring. “We’ll fix consent when the cookie deprecation lands” has no landing date. The deadline that exists is a regulator’s letter or a plaintiff firm’s demand.
- First-party is where tracking went anyway. Server-side tagging, first-party identifiers and CRM matching absorbed the effort — and all of them still require consent. If anything, moving tracking first-party makes it less visible in a naive audit, not more compliant. We covered the pattern in server-side GTM and Consent Mode.
- CHIPS is a scoping tool, not a consent exemption. Partitioning a cookie per top-level site limits cross-site tracking; it does not make the cookie strictly necessary.
- Google’s own modelling still depends on you. Consent Mode’s behavioural modelling and cookieless pings are unaffected by any of this and still hinge on a correct
denieddefault — see GA4 with analytics_storage denied.
The uncomfortable summary
Everyone got a reprieve on the technology and no reprieve at all on the law. Third-party cookies are still there, still readable, still setting themselves before your banner resolves — and the enforcement trend around pre-consent tracking has only sharpened, as our 2026 global snapshot lays out. The single genuine change is that you can no longer wait for Chrome to solve it for you.